Hello,
I have a single PBS that handles backups from PVE1, PVE2, and PVE3 (all single node clusters).
My PBS has a single user with full admin privileges (this is a Tuxis PBS server, so I can only have one user). I'm using API tokens and permission scoping to make sure backup clients only have enough permissions to do backups. All other maintenance operations are performed server-side.
Each single node cluster has a separate namespace, and the single Backup User uses a separate API token for each namespace/cluster. I'm a hobbyist/home/small office user, but this felt like the most correct way to do it as far as privilege separation. Two unrelated clusters shouldn't share the same credentials.
However, I've run into an interesting potential problem. It doesn't feel like it should be a problem, which makes me think my understanding of how PBS works and should be used is incomplete.
If I have a full backup of PVE1, and it explodes and dies, I would want to restore the guests from PBS' PVE1 namespace to, say, PVE2.
So…that doesn't seem wrong (because privilege separation is the correct thing to do), but it's also a fairly manual process on the PBS side; the way I'm imagining .
All that makes me think I've conceived of my namespace setup or token privilege scoping setup wrong. But I'm lost on a "more correct" way to do it.
Am I actually missing something, or is there not meant to be a smoother way to restore backups created by a PVE node having a first owner to a second PVE node having a second owner than the manual intervention process I outlined above? If that's the case, I'm not complaining.
I have a single PBS that handles backups from PVE1, PVE2, and PVE3 (all single node clusters).
My PBS has a single user with full admin privileges (this is a Tuxis PBS server, so I can only have one user). I'm using API tokens and permission scoping to make sure backup clients only have enough permissions to do backups. All other maintenance operations are performed server-side.
Each single node cluster has a separate namespace, and the single Backup User uses a separate API token for each namespace/cluster. I'm a hobbyist/home/small office user, but this felt like the most correct way to do it as far as privilege separation. Two unrelated clusters shouldn't share the same credentials.
However, I've run into an interesting potential problem. It doesn't feel like it should be a problem, which makes me think my understanding of how PBS works and should be used is incomplete.
If I have a full backup of PVE1, and it explodes and dies, I would want to restore the guests from PBS' PVE1 namespace to, say, PVE2.
- But PVE2 uses an entirely separate API token, and PBS tracks ownership of backup files based on the API token/user that made the backups.
- So, if I tried to restore the backups from PVE1 to PVE2 via PVE2's connection to the PBS server, I would need to:
- [On PBS] Copy or move the backup to PVE2's namespace.
- [On PBS] Change the ownership of the backup to the token associated with PVE2 to avoid an ownership mismatch error.
- [On PVE2] Restore from backup.
So…that doesn't seem wrong (because privilege separation is the correct thing to do), but it's also a fairly manual process on the PBS side; the way I'm imagining .
- I know that PVE and PBS are business-class products first, so it doesn't make sense to me that there's no a smoother way to do it. That's what makes me think I'm missing something, and what led to this post.
- PBS doesn't seem to have any sort of "super owner" privilege that lets certain users perform operations on backups that the user (of more accurately, the API token that created/owns the backup) doesn't own. So, there's nothing I can see that instructs PBS and PVE to ignore the ownership of the backup and restore it to where I tell it to.
- The fact that an API token privileged to a single namespace cannot see into other namespaces on the same level of the hierarchy also complicates this.
All that makes me think I've conceived of my namespace setup or token privilege scoping setup wrong. But I'm lost on a "more correct" way to do it.
Am I actually missing something, or is there not meant to be a smoother way to restore backups created by a PVE node having a first owner to a second PVE node having a second owner than the manual intervention process I outlined above? If that's the case, I'm not complaining.